Record Retention Policies

Record Retention Policies present a host of issues beyond the retention and destruction[1] procedures that well-managed businesses would adopt if commercial concerns such as corporate governance and risk management were the only considerations. Furthermore, these Policies are better described as Record Destruction Policies because their principal goal is to set a date when records can safely be discarded without fear of financial or other adverse consequences.

Whether a particular document’s retention will turn out to be beneficial or detrimental depends on the circumstances and the document itself and should take into account legal, litigation, and business requirements. A separate education of employees is required to avoid the preparation of potentially detrimental documents. For example, despite constant reminders, thoughtless e-mails written in haste often come back to haunt the sender as “smoking guns” in litigation.

Goals and Adoption of a Record Retention Policy

Record Retention Policies are regulated by multiple rules and laws. First, there are certain U.S. legal requirements to maintain certain records for designated periods, and to provide them to government agencies under certain conditions. Second, there are basic corporate records and important agreements and other documents that should be retained and safeguarded. Finally, there are evidentiary and discovery requirements if the Company becomes involved in litigation or regulatory proceedings.

A thorough Record Retention Policy provides retention guidelines and procedures for storage, organization, retrieval and, ultimately, destruction of documents. The Policy designates the individuals responsible for compliance, and the Policy provides for the suspension of the Policy in the event of litigation or an investigation or other designated events.

There are two kinds of company records, temporary records and final records. Temporary records include all business documents that are intended to be superseded by final records, or that are intended to be used only for a limited period of time, including written memoranda and dictation to be typed in the future, reminders, to-do lists, drafts, and interoffice correspondence regarding a client or business transaction. Temporary records can be destroyed or permanently deleted if in electronic form when a project or matter closes. Before destroying or deleting temporary records, ensure that you have duplicates of all final records pertaining to the project or matter, and organize final records (and duplicates) in a file marked “final.” Then, store the final records appropriately as required by the Policy.

Final records include all business documents that are not superseded by modification or addition, including documents given (or sent via electronic form) to any third party or government agency, final memoranda and reports, correspondence, handwritten telephone memoranda not further transcribed, minutes, specifications, journal entries, cost estimates, and the like. All accounting records should be deemed final records. All final records may be discarded 10 years after the close of a project or matter.[2] Further, permanent records include all business documents that define a company’s scope of work, expressions of professional opinions, research, and reference materials, including, but not limited to contracts, proposals, materials referencing expert opinions, financial statements, tax returns, payroll registers, copyright and trademark registrations, patents and other documents relating to intellectual property rights, environmental reports, real estate records, and formal minutes of meetings. Permanent records are final records that should be retained indefinitely.

The typical Record Retention Policy divides documents broadly into two categories:

I. No Retention: Records that can be discarded immediately.

II. Designated Retention: Retention for specified periods, or permanently, as appropriate.

Since retention of hard copies and electronic documents is expensive and often time-consuming, the most common preference is toward discarding any documents that are not required to be maintained. Unfortunately, even a general destruction policy can sometimes raise adverse inferences in litigation.

Because of their importance, Record Retention Policies should be reviewed and approved by senior management, should be communicated to and acknowledged by all relevant employees, and should be enforced consistently. Violations, in the form of either early destruction or late retention, should be treated seriously and should be remedied and disciplined if appropriate. As a client, your General Counsel’s Office should have a designated attorney or designated outside counsel to supervise the Policy, to interpret it in specific cases, and to supervise employees’ training.

For a full listing of document retention periods, please see the Schedule at the end of this Advisory. 

The Federal Rules of Civil Procedure and its Applications

The Federal Rules of Civil Procedure, last amended in 2022, have extensive and demanding e-data discovery rules, with early “meet & confer” requirements and schedule agreements, negotiation of “easily accessible” and other e-data, with possible shifting of discovery costs, privilege issues, agreement on the forms of production of e-data and records, and safe harbors for good faith loss or destruction of relevant electronic records. These rules require counsel to become quickly expert regarding every aspect of their client’s record retention policies and procedures.

Under FRCP 26(f), parties must “meet and confer” as soon as practicable and at least 21 days before a scheduling conference is to be held or scheduling order is due. This requires immediate assembly of the legal and business team and advisers, identification of the “most knowledgeable” persons, and an immediate plan for e-discovery and implementation of the “litigation hold.” A “litigation hold” is a process to preserve all data that might relate to a legal action involving the company or a particular matter or project, which may also be called a legal hold, preservation order, or hold order. The retention policy must be analyzed with the IT staff, who will be critical in the process, and corrected if necessary to ensure adequacy and reliability.

Where in the world is the potentially discoverable data, and how is it stored and protected? Is the data reasonably accessible, and, if not, is it nonetheless discoverable if “good cause” is shown under FRCP 26(b)(2)? The accessibility burden is on the party resisting discovery. Is the “litigation hold” clear, correctly implemented, and enforced? Are the discovery review software and systems adequate, flexible and protective of confidentiality? Inadvertent disclosures are now easier to “call back,” but are still best avoided to begin with.

FRCP Rule 37(f) provides a “safe harbor” for documents inadvertently destroyed despite “good faith efforts” to maintain and abide by a record retention program. An effective program, in place and enforced, is required to claim this position, and can avoid adverse inferences and worse. Absent such a program, the safe harbor will not be available.

In summary, the core of the Federal Rules is an effective record retention program, in place and enforced, before the discovery requests arrive.

In general commercial litigation, immediate holds are put on document destruction, but with an automatic destruction program in place, that might be too late to save an important writing, and most substantial corporations are constantly involved in various litigations, so that determining the proper depth of a direction to hold all documents might be difficult or impossible to assess until after the fact.

Even given the substantial costs of document archiving, there are advantages to retention and explanation, as opposed to destruction with possible adverse inferences or worse. If a document is created which clearly presents an issue, then attach a contemporaneous explanation of it and why it is incorrect or misleading. Then at least the record is there if the need ever arises. But, applying this general concept to the real world is extremely difficult in practice.

On the other hand, the relative costs of electronic data retention, versus the often more expensive alternative of effecting a disciplined destruction program, result in many modern businesses keeping everything virtually forever. This often occurs in legacy systems which fall increasingly out of date, except as purely old record storage systems, but they are still subject to future discovery requests and often present only a possible litigation liability with little or no current business value.

Mergers

In mergers, our first caveat to the parties is to assume that anything and everything written about the deal is subject to a Section 4(c) filing with the Hart-Scott-Rodino pre-merger notice, and these writings could be a roadmap to an antitrust issue that simply might not otherwise occur to the antitrust regulators.

Sarbanes-Oxley Act and its Applications

The Sarbanes-Oxley Act of 2002 and its regulations require the auditors of public U.S. companies to retain their audit work papers and related information for seven years after the relevant audit’s conclusion. SOX also contains obstruction of justice provisions, which criminalize the destruction or alteration of documents with the intent to obstruct a government proceeding. These SOX provisions apply to anyone and everyone, including public companies, private companies, their auditors and their lawyers and anyone else who violates the law. SOX Section 1102 states that whoever corruptly: (i) alters, destroys, mutilates, or conceals a record, document, or other object or attempts to do so, with the intent to impair the object’s integrity or availability for use in an official proceeding; or (ii) otherwise obstructs, influences or impedes any official proceeding, or attempts to do so, shall be fined or imprisoned for not more than 20 years or both.

Deliberately withholding records obviously can attract sanctions and worse. In January 2008, a federal court ordered telecom giant Qualcomm Inc. to pay $8.6 million in sanctions and asked the California state bar to investigate six of its attorneys for ethical violations after finding that it deliberately withheld nearly 50,000 documents from discovery in a patent dispute with rival Broadcom Corp. The court also ordered Qualcomm and its attorneys to undertake a comprehensive review of discovery failures in the case and develop a case-management protocol that would avoid similar scenarios in future cases.

Destruction of Records

While hard copies of documents are easy to destroy, electronic copies sometimes rise like the Phoenix from the ashes, often at the most inopportune times. There are procedures to render electronic files unrecoverable, but forensic recovery methods are constantly becoming more sophisticated. And if records exist and are destroyed or not produced after a proper demand is made, penalties can include judicial sanctions and even dismissal of the case.[3]

Logically, destruction of electronic records should raise no more of an adverse inference than destruction of hard copy records, provided that there then exists no reasonably foreseeable reason for further retention. However, the instant that litigation or regulatory proceedings become reasonably foreseeable, an immediate hold must be imposed on all possibly relevant documents and sources. In the case of a corporate client with diverse operations, it may be virtually impossible to conclude with confidence that a record in one location can be destroyed, since the possibility might exist that it is relevant to or subject to discovery in a case or proceeding in another jurisdiction far away.[4]

If records are discarded after a litigation or proceeding is reasonably foreseeable, it is simply no excuse to say that the documents were destroyed since the Policy applied automatically[5], and the risk of sanctions or worse is present with electronic documents to exactly the same extent as with hard copies. The majority of the recent sanctions cases have involved failure to produce e-mails to some extent. And where the documents no longer exist, or where the computer systems have been wiped clean or are otherwise not recoverable, the typical inference is that the result was intended, and that the information destroyed would have been adverse to the destroyer.[6] “Litigation Holds” are also relevant to a later claimed attorney work product privilege, since both should be triggered contemporaneously at the time litigation is reasonably anticipated, and the hold directive itself typically is protected as either privileged or work product or both.

As such, if a lawsuit or other proceeding involving the company is reasonably foreseeable, all destruction of any possibly relevant documents must cease immediately. In the event of a litigation hold, a company’s IT department should immediately disable the “permanent delete” and “automatic delete” functions of the company’s software for the designated records and disable the automatic deletion of recycle bins and deleted items folders on appropriate company computers. The records department of the company should immediately suspend all disposition of records maintained on-site or off-site location as appropriate. Lastly, the General Counsel’s Office of the company should immediately notify all appropriate employees that they should not dispose of relevant temporary records or other records until notified otherwise. Once the “litigation hold” is in place with respect to the designated files and documents, regular disposition of non-affected records may resume.

Remember as well that anyone who has had access to the document likely also has had the opportunity to print it or to send a copy to another computer or file, and it is obviously no defense to a discovery request to argue that a relevant document should have been destroyed and that a copy was retained in violation of corporate policy. Furthermore, Index information describing the discarded document may be retained long after the document itself has been wiped clean or overwritten. Moreover, at one time, many considered it wise to delete emails regularly to avoid accidentally retaining those messages that may be detrimental to the company if discovered in litigation. However, as many companies considered that those previously deleted emails were sent to an external party and may be discoverable on that recipient’s electronic storage, conventional wisdom was revised to retain such emails so that, in the event of litigation, the company could avoid being surprised by the resurfacing of such emails and would know and be able to share with its legal counsel everything that may exist.

In summary, prudent corporate planning would suggest the following caveats:

1. Unless a law says otherwise, there is no law against a Document Destruction Policy.

2. If a document has been created, assume that a copy of it exists somewhere.

3. If a document has been created electronically, assume that it can be retrieved.

4. When in doubt, ask. When really in doubt, ask in writing, and save the answer.

Schedule of Document Retention Periods

* * *

[1] There is nothing illegal in any broad sense about a document destruction program, even where possibly relevant documents are destroyed, as long as the later relevant litigation or proceedings were not reasonably foreseen at the time the documents were destroyed. See Arthur Andersen LLP v. U.S., 544 U.S. 696, 704 (2005) (“It is, of course, not wrongful for a manager to instruct his employees to comply with a valid document retention policy under ordinary circumstances.”); Samsung Elecs. Co. v. Rambus, Inc., 439 F. Supp. 2d 524, 543 (E.D. Va. 2006).

[2] The 10-year retention period is a rule of thumb to be used subject to the attached Schedule at the end of this Advisory. In certain cases, our recommendations take a conservative view to avoid destruction or disposal of documents prematurely.

[3] E.g., Plasse v. Tyco Elecs. Corp., 448 F. Supp. 2d 302, 308-11 (D. Mass. 2006); U.S. v. Tamez, Nos. 06 Civ. 3111 (DC), 03 Cr 1439 (DC), 2006 WL 2854336, at *6 (S.D.N.Y. Oct. 5, 2006).

[4] See, e.g., Krumwiede v. Brighton Assocs., L.L.C., No. 05 C 3003, 2006 WL 1308629, at *8 (N.D. Ill. May 8, 2006) (“Once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a litigation hold to ensure the preservation of relevant documents.”).

[5] Lewy v. Remington Arms Co., 836 F.2d 1104, 1112 (8th Cir. 1988) (“Thus, a corporation cannot blindly destroy documents and expect to be shielded by a seemingly innocuous document retention policy”).

[6] See e.g., Plasse, 448 F. Supp. 2d at 309 (“Plaintiff argues that the inaccessible documents are not relevant and their deletion would therefore be meaningless. As the documents have disappeared, the court is in no position to assess this claim; the systematic destruction of these documents certainly suggests otherwise”). The most prominent default judgment case is Coleman (Parent) Holdings, Inc. v. Morgan Stanley & Co., Inc., (Fla. Cir. Ct. 2005), where the compensatory and punitive damages exceeded $1.4 Billion. The leading adverse inference case is Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004), in which a finding of spoilation was permitted upon proof of negligence or gross negligence; but see Itron, Inc. v. Johnston, 2017 U.S. Dist. LEXIS 230670 (S.D. Miss. 2017), in which sanctions for the loss of evidence and a presumption that such lost information was unfavorable during discovery required a showing that the party acted with intent to deprive the other party of the use of such information due to a 2015 amendment to Fed. R. Civ. P. 37(e)(2)(A).

[7] The IRS and the New York Department of Taxation and Finance state that tax correspondence should be retained for three years. The general consensus from legal sources and websites is that legal correspondence should be retained permanently.  How long should I keep records?, IRS (last visited May 15, 2023), https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records; Recordkeeping for businesses, N.Y. Dept. Tax’n & Fin. (last visited May 15, 2023), https://www.tax.ny.gov/bus/doingbus/recordkeeping.htm.

[8] The general consensus from accounting websites is that budget records should be retained for either seven or 10 years, and accounting policies suggest the seven-year rule for financial records. The New York State Division of Budget retains budgets and related information for six years. Records Management Procedures, Appendix A: Records Series Titles & Retention & Disposition Guidelines, Division of the Budget (Mar. 1, 2019).

[9] Cancelled checks for important payments, special contracts, the purchase of assets, taxes, and fixed assets, and checks that are filed with papers pertaining to an underlying transaction, should be retained permanently.

[10] The general consensus from legal sources and websites is that check registers/books should be retained for either seven or ten years.

[11] Some legal sources and websites suggest that credit card receipts do not need to be retained for any period of time after appearing on a credit card or bank statement.

[12] If fiscal policies and procedures are considered supporting documents for tax filings, etc., then the IRS and the New York State requires retention for three years. Also, if the fiscal policies and procedures are expired or superseded, then they may no longer be necessary to keep, depending on their subject matter. How long should I keep records?, IRS (last visited May 15, 2023), https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records; Recordkeeping for businesses, N.Y. Dept. Tax’n & Fin. (last visited May 15, 2023), https://www.tax.ny.gov/bus/doingbus/recordkeeping.htm.

[13] Some legal sources and websites indicate that fixed asset purchase documentation (including invoices, cancelled checks, and depreciation schedules) should be retained permanently, but others indicate that retention for seven years post disposal is sufficient. General purchase orders and invoices should be retained for three years post disposal.

[14] The general consensus from legal sources and websites is that cash receipts/documents should be retained for three years. However, a cash receipt journal should be retained permanently.

[15] The general consensus from legal sources and websites as well as tax sources is that earnings records related to the determination of income tax liability should be retained permanently.

[16] The general consensus from accounting websites is that payroll registers should be retained for seven years. However, the FLSA and the New York State Labor Law only require employers to retain payroll registers for three years. Fact Sheet #21, U.S. Dept. of Labor (FLSA) (last visited May 15, 2023), https://www.dol.gov/agencies/whd/fact-sheets/21-flsa-recordkeeping; Chart of Recordkeeping Requirements, N.Y.S. Bar Ass’n Lab. & Emp. L. (May 15, 2020).

[17] The general consensus from legal sources and websites is that confirmation of employment letters should be retained for seven years post termination. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[18] The general consensus from legal sources and websites is that employee applications and resumes should be retained for three years. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[19] The general consensus from legal sources and websites is that employee offer letters should be retained for seven years post termination. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[20] The general consensus from legal sources and websites is that job descriptions and performance goals should be retained for three years. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[21] OSHA requires employers to retain work-related injuries and illnesses records for five years. Injury and Illness Recordkeeping and Reporting Requirements, OSHA (last visited May 15, 2023), https://www.osha.gov/recordkeeping.

[22] The general consensus from legal sources and websites is that personnel files should be retained for seven years post termination. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[23] The general consensus from legal sources and websites is that salary ranges per job description should be retained for three years. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.

[24] The general consensus from legal sources and websites is that time reports should be retained for seven years post termination. However, EEOC Regulations require employers to retain all personnel or employment records for one year post termination. The U.S. Department of Labor indicates that wage calculation records, such as time cards, wage rates tables, work and time schedules, and records of increases or deductions to wages, should be kept for two years. Recordkeeping Requirements, U.S. Equal Emp. Opportunity Commission (last visited May 15, 2023), https://www.eeoc.gov/employers/recordkeeping-requirements#:~:text=EEOC%20Regulations%20require%20that%20employers,from%20the%20date%20of%20termination.; Fact Sheet #79C, U.S. Dept. of Labor (FLSA) (last visited May 15, 2023), https://www.dol.gov/agencies/whd/fact-sheets/79c-flsa-domestic-service-recordkeeping#:~:text=How%20long%20does%20an%20employer,to%20or%20reductions%20from%20wages.).

[25] OSHA requires employers to retain work-related injuries and illnesses records for five years. New York State Workers’ Compensation Law requires employers to retain injury and illness records for 18 years, even if the injury or illness does not result in a claim. Injury and Illness Recordkeeping and Reporting Requirements, OSHA (last visited May 15, 2023), https://www.osha.gov/recordkeeping; Your Employer’s Rights and Responsibilities, N.Y.S. Workers’ Compensation Board (last visited May 15, 2023), https://www.wcb.ny.gov/content/main/Workers/YourEmployersRightResponsibilities.jsp. 

[26] Some legal sources and websites indicate that expired or terminated contracts should be retained for seven years.

[27] If expired, sources indicate keeping contracts seven years.

[28] Some legal sources and websites indicate that loan documents and promissory notes should be retained for seven years post termination, but others indicate that they should be retained permanently.

Carter Ledyard & Milburn LLP uses Client Advisories to inform clients and other interested parties of noteworthy issues, decisions and legislation which may affect them or their businesses. A Client Advisory does not constitute legal advice or an opinion. This document was not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein. © 2023 Carter Ledyard & Milburn LLP.